PT-2018-10738 · Joyent · Smartos

Ben Murphy · Published 2018-02-12 · Updated 2019-10-09 · CVE-2018-1166

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joyent SmartOS version release-20170803-20170803T064301Z

Description This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the SMBIOC TREE RELE ioctl, resulting from the lack of validating the existence of an object prior to performing operations on the object. This can be leveraged to execute code under the context of the host OS.

Recommendations For Joyent SmartOS version release-20170803-20170803T064301Z, as a temporary workaround, consider disabling the SMBIOC TREE RELE ioctl until a patch is available. Restrict access to the vulnerable ioctl to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

RCE

Weakness Enumeration

CWE-416

CWE-20

Related Identifiers

CVE-2018-1166

ZDI-18-159

Affected Products

Smartos

References · 4

• https://help.joyent.com/hc/en-us/articles/360000124928 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-159 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1166 · Security Note